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Figure 2 




QUARANTINE THE POTENTIALLY MALICIOUS CONTENT 




402 



RECEIVE NETWORK COMMUNICATIONS 
OVER A NETWORK 



404 



SCAN THE NETWORK COMMUNICATIONS 
FOR KNOWN MALICIOUS CODE 




406 



YES 



408 



CLEAN THE COMMUNICATIONS 
TO DISABLE MALICIOUS CODE 



410 



IDENTIFY HEURISTICS ASSOCIATED WITH 
THE NETWORK COMMUNICATIONS 



412 



MONITOR HEURISTICS 



Q END ^) 



Figure 4 



